Automate Your Release Checklist with n8n and GitHub Actions (2026 Guide)

Automate Your Release Checklist with n8n and GitHub Actions

The Claude Code source code leak (March 31, 2026) had a simple cause: a forgotten .map file in the production bundle. A basic automation would have caught it.

Here's how to build that system.

Why are manual releases a critical security risk?

Every team has a release checklist. Most of the time, it lives in the lead developer's head, or in a Notion doc nobody reads.

Result: oversights happen at the worst moment — just before pushing to production.

Pipeline Architecture

Code push → GitHub Actions → Security Scan → Build → Bundle Validation → Publish
                                    ↓                        ↓
                              Slack alert            Blocked if .map detected

1. GitHub Action: Pre-publish Scan

Create .github/workflows/pre-publish-check.yml:

name: Pre-publish Security Scan

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]

jobs:
  security-scan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      
      - name: Install dependencies
        run: npm ci
      
      - name: Build
        run: npm run build
      
      - name: Scan for source maps in dist
        run: |
          if find dist -name "*.map" | grep -q .; then
            echo "❌ Source maps found in dist/ — publish blocked"
            find dist -name "*.map"
            exit 1
          fi
          echo "✅ No .map files in production bundle"
      
      - name: Scan for sensitive files
        run: |
          PATTERNS=(".env" "*.key" "*.pem" "secrets" "credentials")
          for pattern in "${PATTERNS[@]}"; do
            if find dist -name "$pattern" | grep -q .; then
              echo "❌ Sensitive file detected: $pattern"
              exit 1
            fi
          done
          echo "✅ No sensitive files detected"
      
      - name: Check bundle size
        run: |
          SIZE=$(du -sh dist | cut -f1)
          echo "📦 Bundle size: $SIZE"
          SIZE_MB=$(du -sm dist | cut -f1)
          if [ $SIZE_MB -gt 50 ]; then
            echo "⚠️ Abnormally large bundle: ${SIZE_MB} MB — manual review required"
            exit 1
          fi

2. n8n Hook: Failure Notification

When the GitHub Action fails, you want an immediate alert — not an email lost in your inbox.

n8n workflow github-action-failure-alert:

GitHub Webhook (workflow_run failed)
  → Extract data (repo, branch, error message)
  → Slack notification #alerts-devops
  → Create Notion ticket "Action required"
  → Email to tech lead

3. .npmignore: Last Line of Defense

# .npmignore
**/*.map
**/*.map.js
.env*
*.key
*.pem
test/
tests/
__tests__/
*.test.ts
*.spec.ts
.github/
scripts/
docs/
CHANGELOG.md

4. pre-publish hook in package.json

{
  "scripts": {
    "prepublishOnly": "npm run build && npm run security-check",
    "security-check": "node scripts/check-bundle.js"
  }
}

Result

With this pipeline:

• Every push is automatically scanned
• Source maps in production are detected and block publication
• The team is alerted instantly via Slack
• The bundle is audited on every release

All in ~2 hours of setup. This is the type of automation that costs little to implement and prevents disasters like Anthropic's. If you manage cloud infrastructure, our analysis of the Cloudflare outage of November 18, 2025 shows why resilience cannot be improvised.

---

Want us to build this pipeline for your project?

Book a call →